Nine days ago, One app, one mesh described a cleaner boundary around the ForkMesh app, public site, World, and independent servers. This round is about what happens inside that boundary: how quickly work moves, how clearly a reviewer can judge it, and what proof remains when a mirror, an agent, or a reward says it is done.
The changes span the web app, desktop client, Go mirror service, World, and repository-native project records. They are not one giant feature. Together, though, they shorten several loops that used to require a reload, a five-minute wait, a second tool, or a leap of faith.
Review becomes a place to work
The web pull-request page now treats Files changed as a working surface. A real file explorer can switch between hierarchy and flat views, collapse single-child directories, filter by path, and follow the file currently in view. The diff pane supports unified and side-by-side layouts, sticky file headers, status marks, per-file change meters, and viewed files that fold away instead of continuing to occupy the page.
Readiness is no longer a vague green light. The pull detail loads the branch it actually targets, reports how far it is behind, shows live check states—including failed, rejected, cancelled, skipped, and awaiting approval—and offers an authorized Update branch operation. That update is signed and routed through the mirror-side executor rather than asking a browser to improvise a Git mutation.
The desktop side received the same attention. The update control is always discoverable on an open pull, conflict navigation crosses file boundaries, and bulk resolution can take either “ours” or “theirs.” Image changes render as bounded before-and-after previews, including WebP when the optional decoder is present, while paged text diffs retain their file heading and scroll position. Underneath, pull-ledger reconciliation adopts non-conflicting foreign additions, recognizes branches merged outside the app, and refreshes an open detail when its repository-native record moves.
Mirrors carry the conversation, too
A mirror is most useful when “current” means more than “eventually caught the next timer.” Desktop SSH fan-out now keeps a slot per gateway, retries a cooled-down node when it becomes eligible, and still pushes healthy peers while one host is slow. A repository update that lands during a sync no longer loses its immediate fan-out and waits for the safety pass.
The Go service has also taken ownership of native collaboration intake. A signed node event wakes only the changed issue or pull inbox; the daemon leases that row, writes the repository-native record in a temporary worktree, commits it, and acknowledges the exact result with a refs attestation. Reconnects trigger one catch-up sweep, startup checks the collaboration inbox, and a bounded five-minute reconciliation covers a best-effort event that never arrived. No resident desktop or GUI process is required on the server path.
Several less glamorous fixes matter just as much. Slow Git transfers now refresh their stream watchdog instead of failing at a fixed 60 seconds, closing a reported clone failure. Deep health probes no longer publish a stale gap while a newer result is running. The latest release also gained a direct fleet probe and pull-ledger fetch so the desktop can ask a saved host for evidence instead of inferring it from an old catalog row.
Recovery work continued after v0.7.23: current main can repair divergent flagship state, restore authority after a target was retired, and probe a retired target long enough to recover it. These commits are operational repairs, not a claim that a fleet can never diverge.
Agents, chat, and calendars share more context
v0.7.23 embeds a provider-neutral coding-agent runtime whose canonical source remains independently testable Python. Cloudflare Workers AI can run through a signed relay ticket, while an installed Ollama or llama.cpp model can use the same tools locally. File reads and edits, bounded commands, search, tests, lint, Git status, diffs, commits, stash, and restore all stay in the isolated desktop worktree; the model provider never receives filesystem access.
The desktop now presents that work more legibly. Agent prose has its own visual weight, shell commands and output share one terminal panel, streamed text batches instead of reshaping the document on every token, and completion notifications identify and reopen the run that produced them. Context follows a continued session, permission-mode changes survive that continuation, and a run stays active while its background work is still alive.
Coordination around the code moved closer as well. Private shared calendars reached both web and desktop, with device authorization, invite autocomplete, and an optional AI-assisted event draft. Chat gained commands that can turn a conversation into a topic or issue, plus user-managed channel webhooks. Repository activity appears on the Calendar page in current main, after the v0.7.23 cutoff, alongside all-ref activity in the desktop calendar.
Ownership gets a recovery path
The combined app described in the last update now has a more direct front door. The /start flow checks Cloudflare and Vultr credentials, selects a suitable small server, provisions it in visible steps, and can create an operator-owned World joined to the public World by a bridge. Provider keys are used for the step that needs them and are not written into the setup state.
The desktop can also export a complete controller bundle and import it into a new deployment. The review pages show the settings, variables, files, sizes, and excluded rebuildable directories before anything moves. This is deliberately a disaster-recovery tool, not a casual backup format: the bundle can contain node identities, SSH keys, account state, and deployment secrets in clear text. It belongs in encrypted storage, and anyone holding it may be able to act as the node.
A new product-promise guide gives operators a reversible way to test the claim underneath all of this: collaborate, add an independently controlled mirror, take the source host offline, clone from the same repository URL, then restore and verify recovery. Automated checks support that drill; they do not replace signed health, human comprehension, or production observation.
From contribution to public receipt
Direct member tips now leave the Worker's custody boundary entirely. The desktop can generate or import a Solana key, lock it in a separate passphrase-encrypted local vault, build and re-check one transfer, sign it locally, and broadcast it to a public RPC endpoint. The server receives only the resulting public signature for an idempotent recipient notice. Export is possible, but it is deliberately gated by the vault passphrase, an explicit warning, owner-only file permissions, and clipboard clearing.
The new Microjobs surface ties three small fixed rewards to independently checkable outcomes: 0.005 SOL for a genuinely new issue report, 0.05 SOL for a merged pull opened with the MCP agent tool's signed marker, and 0.01 SOL for a public referral post that still contains the link and has sent counted visitors. A claim can be pending, approved, queued, paid, or rejected. Approval creates a public unsigned transfer plan; it does not move money. A configured repository-owner desktop must revalidate, sign, and broadcast the payout from its local vault.
That distinction is intentional. The policy calls these amounts a small thank-you, not employment, an investment, or proof of personhood. Missing AI, reward-pool, signer, or public-evidence configuration fails closed. Issue-reporter credits now have their own leaderboard, while reward comments on closed reports record estimates rather than pretending a payout already happened.
Current main adds the other half of the audit trail: a public financial ledger that projects the canonical tables behind tips, rewards, microjobs, World purchases, and recorded revenue. It separates allocations and pending plans from on-chain receipts, links full transaction signatures when they exist, labels USD values as current estimates, and backfills only known public system-wallet history. It does not scan personal member wallets or turn a pending row into a payment.
Reports are feeding back into the product
Outside reports in this window found an email-verification bypass, delayed session revocation, profile edits that disappeared after reload, malformed signup addresses, an inert profile-picture control, a missing Ubuntu desktop dependency, and the slow-clone timeout. Each report has a corresponding implementation change and closed repository-native issue—not just a reassuring comment.
The same scrutiny now applies to growth loops. Referral click evidence is retained in bounded encrypted or indexed form, suspicious signup bursts can be quarantined without receiving historical credit, and administrators can see quarantined accounts separately. These controls raise the cost of abuse; they are not described as identity proof.
The release line stays visible
The last signed desktop artifact in this reporting window is v0.7.23, built from the August 12 release commit. Web, app, server, and World work merged after that point can ship independently, but Git history alone is not proof of a hosted rollout. This post therefore labels August 13 and August 17 desktop work as current main, and the status page remains the place to check current service health.
Two substantial merged contributions remain deliberately outside the shipped story. Pull request #92 adds mobile secure storage, account deletion, privacy metadata, accessibility work, and an App Store submission checklist; it is launch readiness, not evidence of an App Store release. Pull request #93 refreshes the separate /new-home preview; it has not replaced the default landing page. Useful progress does not need a larger claim than the record supports.
Get the latest desktop release, open the app, read the operating guides, or visit ForkMesh World.